Detecting LAPS Password Abuse: Reads of Managed Admin Passwords

LAPS removes shared local administrator passwords, but it moves the secret into Active Directory. Whoever holds read rights on the attribute can fetch the local admin password for every host in scope, which is exactly what attackers do after they compromise a helpdesk or delegated account. Auditing reads, and auditing who can read, covers both the attack and its precondition.

Signals at a Glance

Auditing the Read

Directory-service access auditing records property reads only if the computer objects carry a SACL for them. Once it is on, Event ID 4662 shows the read, but the Properties field holds the schema GUID of the attribute, and that GUID is specific to your forest because the LAPS attribute is a schema extension. Look it up once and put it in the rule:

# Run once per forest and keep the value in your detection config
# (tune/validate). Legacy LAPS attribute:
$schema = (Get-ADRootDSE).schemaNamingContext
$o = Get-ADObject -SearchBase $schema -Filter { name -eq 'ms-Mcs-AdmPwd' } `
     -Properties schemaIDGUID
[guid]$o.schemaIDGUID
# Windows LAPS attributes use the same lookup for msLAPS-Password and
# msLAPS-EncryptedPassword.

let lapsGuid = "00000000-0000-0000-0000-000000000000";   // tune/validate: your schema GUID
let lapsReaders = dynamic(["svc-laps-reader","helpdesk-t2"]);   // documented readers
SecurityEvent
| where EventID == 4662
| where Properties has lapsGuid
| where SubjectUserName !in (lapsReaders) and SubjectUserName !endswith "$"
| summarize hosts = dcount(ObjectName), first = min(TimeGenerated), last = max(TimeGenerated)
          by SubjectUserName, SubjectLogonId, bin(TimeGenerated, 15m)
| order by hosts desc

Who Can Read, and What Happens Next

A read by an authorised helpdesk user is normal. A read by an account that has never done it, or a read of hundreds of objects in minutes, is not. Review the preconditions on a schedule, and correlate the read with the local logon that follows:

• Use the LAPS PowerShell module to list extended-rights holders: Find-AdmPwdExtendedRights for legacy LAPS and Find-LapsADExtendedRights for Windows LAPS. Remove any principal that is not documented.
• Prefer Windows LAPS with password encryption and an authorised-decryptors group, so reading the attribute alone does not yield a usable secret.
• Correlate a successful read with a 4624 type 3 or type 10 logon to the same host by the built-in or LAPS-managed administrator, from the reading account’s workstation.
• Alert on bulk reads by a single session: a legitimate retrieval touches one host at a time.
• Do not grant All Extended Rights on OUs that contain LAPS-managed computers; that right includes the password attribute.